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DETAILED ACTION 



1. 



This office action is in response to the RCE filed on 3/31/08. 



2. 



Claims 1-40 are pending. 



Continued Examination Under 37 CFR 1.114 



3. A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 3/31/08 
has been entered. 

Response to Amendment 

4. The objection to claim 17 is withdrawn as the amendment overcomes the 
objection. 



5. Applicant's arguments with respect to the Griffin prior art are persuasive. These 
rejections are withdrawn. 

6. Applicant's arguments with respect to the prior art rejections of the amended 
claims under Elgamal have been considered but are not persuasive. 



Response to Arguments 
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7. On pgs. 21-23, applicant argues that the prior art does not disclose determining a 
minimum cryptography service parameter threshold, and suggesting or forcing at least 
one alternative cryptography service, wherein the alternative cryptography service 
meets or exceeds the minimum level of security. However, Elgamal discloses 
ascertaining whether a crypto module correctly implements algorithms and/or key sizes 
configured by performing conformance tests on these algorithms. ("Accordingly, the 
conformance tests in accordance with the present invention are sufficiently broad to 
ensure that the cryptographic module is correctly implementing the algorithms and that 
the key sizes advertised thereform are indeed being used", col. 6:6-10) These 
conformance parameters define whether a cryptographic service is adequately 
implemented; hence, these conformance parameters suggest determining a minimum 
cryptographic parameter. Furthermore, it is well known in the art to suggest or force 
use of at least one alternative service as part of a correctness detection action. (See De 
Bonet below) Moreover, it would be obvious for an alternative cryptographic service to 
have a higher level of security than represented by the parameter threshold because a 
request for a cryptographic service that did not pass the conformance test of Elgamal 
would be replaced by an alternative cryptographic service that did pass its conformance 
test. For these reasons, the claims remain rejected under the prior art of record. 



Claim Rejections - 35 USC § 103 
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8. Claims 1-7, 10-21, 23-33 and 35-40 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Elgamal et al. USPN 6,397,330 (hereinafter Elgamal) in view of 
De Bonet USPN 7,246,360. (hereinafter De Bonet) 

9. As per claims 16-21 and 23-28, Elgamal discloses a computer readable medium 
having computer-implementable instructions embodied thereon, which when executed 
cause one or more processing units to perform acts comprising: 

a. Establishing at least one cryptography service parameter threshold 
comprising a minimum cryptography service parameter; selectively detecting a 
request for at least one cryptography service; and selectively performing at least 
one correctness detection action based on said requested cryptography service 
and the at least one cryptography service parameter threshold (Col. 5:60-6:14; 
6:19-37 and lines 53-55; 7:1 1-28 [conformance test parameters defines a min 
cryptography service parameter]) 

b. Establishing at least one maximum cryptography service parameter 
threshold; (Col. 5:60-6:46) 

c. wherein establishing said at least one of either the minimum or maximum 
cryptography service parameter threshold includes at least one of the following 
acts: identifying unacceptable cryptography algorithms; and identifying 
acceptable cryptography algorithms (6:26-27 and lines 57-60; 7:15-17 and lines 
22-28); 
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d. wherein establishing said at least one of either the minimum or maximum 
cryptography service parameter threshold includes at least one of the following 
acts: identifying at least one unacceptable cryptography key size parameter; and 
identifying at least one acceptable cryptography key size parameter (5:66-6:2; 
6:25-31 and lines 53-56); 

e. wherein establishing said at least one of either the minimum or maximum 
cryptography service parameter threshold includes establishing a plurality of 
correctness categories, wherein each at least one of said plurality of correctness 
categories includes at least one cryptography algorithm identifier (6:57-65; 8:1-34 
"Table 2"); 

f. wherein said plurality of correctness categories includes at least one 
correctness category selected from a group of correctness categories comprising 
authorized algorithms, unauthorized algorithms, weak algorithms, and strong 
algorithms (5:66-6:2; 6:25-37); 

g. wherein selectively detecting said request for at least one cryptography 
service includes monitoring at least one process selected from a group of 
processes comprising an application, an operating system, a cryptography 
algorithm, and a cryptography application programming interface. (5:60-61; 6:19- 
21) 

h. wherein selectively performing said at least one correctness detection 
action based on said requested cryptography service if said requested 
cryptography service does not satisfy said at least one cryptography service 



Application/Control Number: 10/759,636 Page 6 

Art Unit: 2132 

parameter threshold includes determining if a cryptographic key associated with 
said requested cryptography service is suitable for use based on said at least 
one cryptography service parameter threshold (6:2; 6:25-31); 
i. wherein determining if said cryptographic key associated with said 
requested cryptography service is suitable for use based on said at least one 
cryptography service parameter threshold includes comparing a size of said 
cryptographic key with said at least one cryptography service parameter 
threshold (6:2; 6:25); 

j. wherein selectively performing said at least one correctness detection 
action based on said requested cryptography service if said requested 
cryptography service does not satisfy said at least one cryptography service 
parameter threshold includes determining if a cryptographic algorithm associated 
with said requested cryptography service is suitable for use based on said at 
least one cryptography service parameter threshold (5:66-6:4; 6:25-35; 7:15-20); 
k. wherein determining if said cryptographic algorithm associated with said 
requested cryptography service is suitable for use based on said at least one 
cryptography service parameter threshold further includes comparing a 
cryptography algorithm identifier with said at least one cryptography service 
parameter threshold (5:66-6:4; 6:25-35; 7:15-20); 

I. wherein selectively performing said at least one correctness detection 
action based on said requested cryptography service if said requested 
cryptography service does not satisfy said at least one cryptography service 
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parameter threshold includes performing at least one action selected from a 
group of actions comprising interrupting at least one process, stopping at least 
one process, starting at least one process, displaying alert information, logging 
alert information, suggesting at least one alternative cryptography service, 
outputting alert messages, and causing alteration of a graphical user interface 
(6:3-4, 30 and lines 57-60). 
Elgamal does not disclose wherein the at least one correctness detection action 
selectively performing includes forcing use of at least one alternative cryptographic 
service. However, it is well known in the art to require an alternative service when a 
client is not authorized to access a requested service. For example, De Bonet discloses 
an API, wherein when a proxy receives a request from a client and the client is not 
authorized to access the requested resource, the request may be modified to identify a 
different resource for which the client has access authorization. Col. 7:25-32. It would 
be obvious to one of ordinary skill in the art at the time the invention was made wherein 
the at least one correctness detection action selectively performed includes forcing use 
of at least one alternative cryptographic service. One would be motivated to do so to 
ensure that the client receives a viable alternative service if the initial requested service 
is not available as known to one of ordinary skill in the art. The aforementioned cover 
the limitations of claims 16-21 and 23-28. 

10. As per claims 1-7 and 10-15, they are method claims corresponding to claims 16- 
21 and 23-28. In addition, Elgamal in view of De Bonet suggest wherein the alternative 
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cryptography service comprises a cryptography service which meets the minimum level 
of security, (an alternative service defined by the policy file will meet all the 
conformance parameters) It would be obvious to one of ordinary skill in the art at the 
time the invention was made wherein the at least one correctness detection action 
selectively performed includes suggesting at least one alternative cryptographic service. 
One would be motivated to do so to ensure that the client receives a viable alternative 
service if the initial requested service is not available as known to one of ordinary skill in 
the art and as suggested by De Bonet, ibid. Therefore, claims 1-7 and 10-15 are 
rejected as being unpatentable over Elgamal in view of De Bonet for the same reasons 
set forth in the rejections of claims 16-21 and 23-28. 

11. As per claims 29-33 and 35-40, they are apparatus claims corresponding to 
claims 16-21 and 23-28. In addition, Elgamal discloses cryptography correctness 
detection logic configured to perform the acts listed in claims 16-21 and 23-28, and 
moreover, Elgamal discloses memory operatively coupled to the correctness detection 
logic, wherein the cryptography service parameter threshold is in the memory, (fig. 1, 
"Policy Filters" and related text) Furthermore, Elgamal in view of De Bonet suggest 
selectively perform at least one correctness detection action based on the requested 
cryptography service if the requested cryptography service does not satisfy the at least 
one cryptography service parameter threshold, wherein the at least one correctness 
detection action selectively performed includes forcing use of at least one other 
cryptography service, wherein the at least one other cryptography service comprises a 
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cryptography service having a higher level of security than represented by the 
cryptography service parameter threshold. (A request for a cryptographic service that 
did not pass the conformance test is replaced by an alternative cryptographic service 
that did pass its conformance test) It would be obvious to one of ordinary skill in the art 
at the time the invention was made wherein the at least one correctness detection 
action selectively performed includes forcing use of at least one alternative 
cryptographic service. One would be motivated to do so to ensure that the client 
receives a viable alternative service if the initial requested service is not available as 
known to one of ordinary skill in the art and as suggested by De Bonet, ibid. As such, 
claims 29-33 and 35-40 are rejected as being unpatentable over Elgamal in view of De 
Bonet. 

12. Claims 8, 9, 22 and 34 are rejected under 35 U.S.C. 1 03(a) as being 
unpatentable over Elgamal in view of De Bonet and further in view of Fielder et al. 
USPN 5,963,646 (hereinafter Fielder). 

1 3. As per claim 22, the rejection of claim 1 7 under 35 USC 1 03(a) as being 
unpatentable over Elgamal in view of De Bonet is incorporated herein. In addition, 
Elgamal discloses disabling a crypto module if the module does not correctly implement 
the algorithms and/or key sizes configured, and removing unauthorized cipher suites, 
wherein a cipher suite is a collection of encryption algorithms, key sizes, and 
parameters that specifies the type and strength of a particular cryptographic operation. 
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(Col. 5:66-6:5; 6:25-31) Elgamal does not expressly disclose, wherein establishing said 
at least one of either the minimum or maximum cryptography service parameter 
threshold includes at least one of the following acts: identifying at least one acceptable 
seed size parameter; and identifying at least one unacceptable seed size parameter. 
However, it is well known in the art at the time of invention that the length or size of a 
seed value, which is used to generate a cryptographic key directly, corresponds to the 
cryptographic strength of the key value used in a cipher function. For example, Fielder 
discloses a key generator that takes as inputs one or more seed values to generate a 
deterministic encryption key. Fig. 2. Fielder further discloses that the size of the seed 
value has a direct relationship to the strength of the generated encryption key. Col. 
5:54-6:4. Hence, a seed value is a significant parameter that specifies the type and 
strength of a particular cryptographic operation. Therefore, it would be obvious to one 
of ordinary skill in the art at the time the invention was made for the act of establishing 
the at least one cryptographic service parameter threshold as disclosed by Elgamal to 
include at least one of the following acts: identifying at least one acceptable seed size 
parameter; and identifying at least one unacceptable seed size parameter. One would 
be motivated to do so because seed size directly corresponds to the strength of a 
particular cryptographic operation as taught by Fielder and as known to one of ordinary 
skill in the art. The aforementioned covers the limitation of claim 22. 

14. As per claims 8 and 9, they are method claims corresponding to claim 22, and 
they do not teach or define above the information claimed in claim 22. Therefore, 
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claims 8 and 9 are rejected as being unpatentable over Elgamal in view of De Bonet 
and Fielder for the same reasons set forth in the rejection of claim 22. 

15. As per claim 34, it is an apparatus claims corresponding to claims 22 and 30, and 
it does not teach or define above the information claimed in claims 22 and 30. 
Therefore, claim 34 is rejected as being unpatentable over Elgamal in view of De Bonet 
and Fielder for the same reasons set forth in the rejection of claim 22 and 30. 

Conclusion 

16. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. See enclosed PTO-892. 

Communications Inquiry 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jung W. Kim whose telephone number is 571-272-3804. 
The examiner can normally be reached on M-F 9:00-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on 571-272-3799. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 



Application/Control Number: 10/759,636 Page 12 

Art Unit: 2132 

information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



/Jung Kim/ 

Primary Examiner, AU 2132 



